Elker
An anonymous whistleblowing platform for employers. We built it from scratch in 2018 and still run the whole stack, from the Rails API through to the mobile app.
Visit elker.com
Overview
Somewhere safe to say the difficult thing.
Elker gives employees a way to report harassment, fraud and misconduct without putting their name to it, and gives the organisation a workable process for what arrives. Reports come in through a web portal, a phone line or a mobile app, then move through triage, investigation and resolution inside one case file.
We built it from the ground up in 2018 and have been the engineering team ever since — through the whole journey from an early-stage idea to a business whose clients include KPMG.
The challenge
Anonymity that has to survive contact with an investigation.
A whistleblowing report is the most sensitive record an employer will ever hold. The reporter has to stay anonymous even from the people investigating them, yet those investigators still need to ask follow-up questions and build a defensible case. Those two requirements pull hard against each other.
The commercial requirement was just as unforgiving. One organisation's reports surfacing inside another's account is not a bug you recover from, and enterprise buyers audit for exactly that before they sign.
The solution
Isolation at the database, not in the query.
Every client organisation gets its own PostgreSQL schema. Tenant separation is enforced a layer below application code, so a forgotten scope in a query cannot leak data across accounts — the connection simply cannot see another tenant's tables.
Anonymity works through report tokens rather than accounts. A reporter keeps a token instead of a login, which lets them return to a two-way conversation with the investigation team while the platform never holds an identity to expose. Each client configures its own report flows, categories and routing rules on top.
The stack is ours end to end: a Rails API, a Vue 3 single-page app for administrators, and a React Native mobile app. Around the core we built case management with SSO and role-based permissions, scheduled retention policies that delete records on the client's own timetable, and dashboards that report on volumes and response times without exposing the reports themselves.
Outcome
Eight years, one engineering team.
Elker went from an idea to an established product with enterprise customers, and the architecture set out in 2018 has carried every one of them. We are still the team building it.